Updates waiting
WordPress, theme and plugin versions, and which have updates waiting. It refreshes WordPress's own update check first if it's more than 12 hours old.
Home / WordPress care plans
For WordPress care plans
WordPress monitoring for care plans
Sell a care plan and you're promising nothing slips. TideStat watches every client's WordPress site from outside, and a small read-only plugin shows what only the inside can: updates waiting, risky settings and tasks that have stopped running.
From inside
What the plugin sees
The things an outside check can't, each one an item in the Fix list when it needs attention.
Plugins WordPress can't check
Usually paid or custom plugins that never show an update notice, so they quietly fall behind.
“Discourage search engines” left on
The tick box that hides a site from Google, often left on after launch.
Debug messages shown to visitors
Error details on the page look broken to visitors and give attackers clues.
File editor, registration and admins
Whether the code editor is on, whether anyone can register and with which role, how many administrators there are and whether one is still called “admin”.
Stuck scheduled tasks
Backups, emails and publishing that rely on WordPress's scheduler, and have stopped running.
Read-only and signed
Safe to put on a client's site
The plugin can only read. It cannot install, update, change or delete anything. Every report is signed with the site's own connection key (HMAC-SHA256) and is only valid for 5 minutes, so nobody can fake or replay it. No content, passwords, visitor data or personal details leave the site.
- Download it from the site pageIn TideStat, open the client's site and choose “Download WordPress plugin”. That copy is already connected to that site.
- Upload and activateIn WordPress: Plugins → Add New → Upload Plugin, choose the file and activate it.
- Open any admin pageThe plugin sends its first report straight away. Results appear in TideStat within minutes.
Installing on several sites from one file? The plain download asks for each site's connection key under Settings → TideStat instead. A connected plugin also proves you look after the site.
From outside, no plugin needed
Looked at the way an attacker would
Every week TideStat also checks each site from outside and flags what's out of date or left open.
- Software past its end of life: PHP, web server, WordPress and jQuery against their support dates
- Secret files left public: .env files, .git folders, wp-config backups and phpinfo pages
- Open folders and old encryption: folder listings, outdated TLS and missing security headers
- Everything else: uptime, speed, search, accessibility and email. See monitoring
Proof for the care plan
Show clients what their care plan does
The monthly report and the client login show what was checked, what changed and what was fixed, so the care plan fee is backed by something they can read. On Agency 25 and Agency 100 it carries your branding.
Server and software checks and the plugin come with every paid plan. See plans.
Plugin questions
Can the plugin change anything on the site?
No. It can only read the details listed on this page and send them to TideStat. It cannot install, update, change or delete anything.
What does it send, and when?
Version numbers, the list of plugins and their updates, the settings above, the number of administrators and how many scheduled tasks are overdue. No content, passwords, visitor data or users' personal details. It sends when you connect, after an update, and once a week.
How do you know a report really came from the site?
Every report is signed with the site's own connection key (HMAC-SHA256) and is only accepted for 5 minutes, so it can't be faked or replayed.
Do I need the plugin at all?
No. TideStat's outside checks work on any WordPress site without it. The plugin adds what can only be seen from inside, such as updates waiting and the “Discourage search engines” setting.
Which versions does it support?
WordPress 5.8 or newer on PHP 7.4 or newer.
Read next
Care plans that catch things first.
Tell us how many WordPress sites you look after and we'll set you up. Early access is free while we onboard agencies personally.